Operational partnerships - Disclosure of information to Business Crime Reduction Partnerships SOP (O31a)

1. Summary of changes

1.1. This standard operating procedure (SOP) has been reviewed in September 2024, the following amendments have been made:

• paragraph 3.4.2 amended.

2. What this procedure is about

2.1. Kent Police works closely with Business Crime Reduction Partnerships (BCRP's) within the force area as part of its statutory obligations set out in Section 6 of the Crime and Disorder Act 1998, and its common law duty to prevent and detect crime. For the purposes of the General Data Protection Regulations and the Data Protection Act 2018, each BCRP is an entity in its own right, and for the purposes of data protection are registered as controllers with the Information Commissioners Office.

2.2. This SOP provides a strategic framework that:

(a) provides guidance to partnerships as regards information sharing, and to enable them to make balanced decisions in relation to exclusion notices

(b) reduces the opportunity for crime and anti-social behaviour

(c) protects staff against acts of physical violence and verbal abuse which often leads to stress and related disorder

(d) reduces the incidents of crime and fear of crime, which benefits staff, visitors and customers
 
Compliance with this SOP and any governing policy is mandatory.

3. Detail the procedure

3.1. Lawful basis for sharing special category and criminal data

3.1.1. When carrying out law enforcement processing, Kent Police is defined as a competent authority; its data protection obligations falling within the scope of Part 3 of the Data Protection Act 2018(DPA). Other bodies including Business Crime Reduction Partnerships (BCRP's) fall within the provisions of the GDPR and differing parts of the DPA. For further information refer to:
NPCC APP manual of guidance on Data Protection Act 2018 (DPA).

Lists of relevant legislation and policy can be found further in this document.

3.1.2. It is important when sharing information for the purposes described in paragraph two, that it is done so in accordance with the GDPR, the Data Protection Act, as well as any other relevant legislation. It should also be done transparently. To ensure this is so, we have entered into an Information Sharing Agreement (ISA) with each individual Business Crime Reduction Partnerships, which follow the Codes of Practice published by the Information Commissioners Office.

Typically each agreement will include details such as:

• details of the controllers forming part of the agreement, as well as their data protection officer details
• the lawful bases applied to the collection and sharing of personal data
• the recipients of the information
• subject rights
• how long records will be retained
• the transfer of data outside of the EEA
• how to complain to the Information Commissioner
• the ISA which has been agreed with each of the BCRPs will follow a similar structure, however it cannot be assumed that the contents will be exactly the same. Before sharing information officers and staff should familiarise themselves with the contents of the latest version of any agreement in place relating to the partnership they are working with to ensure information sharing is carried out proportionately and lawfully. It should also be remembered that when considering requests to share personal data, it should be on a case by case basis, and in compliance with the procedures and constraints set out in this and other policies. An information sharing agreement does not give a blanket authority for personal data to be shared automatically, without due reference to the relevant legislation

3.2. Information sharing in practice

3.2.1. Sharing of personal data will be facilitated by the use of the form ‘K-MIP record of sharing’. This is mandatory and should be provided to applicants for completion. Secure methods of transporting such requests and responses should be adhered to; electronically by secure email, but where this is not possible it must be transported in person or by post (if appropriate).

3.2.2. Information sharing forms must be attached to the relevant Athena record for auditing purposes; such forms should be titled ‘information sharing’ followed by the organisation with which the information was shared. Once the information has be used by the BCRP the electronic copy of the form K-MIP will be destroyed by relevant BCRP.

3.2.3. Disclosure of personal data may be made to Business Crime Reduction Partnerships (BCRP’s) in limited circumstance. The circumstances are:

• where any person is charged with or cautioned;
• where any person has accepted the offer of an Out of Court Resolution, including a Community Resolution or agreed to a structured programme of education, diversion or intervention through Outcome 22;
• where a summons has been issued for an offence;
• where any person has breached an order to leave a location under Section 35, Anti-social Behaviour, Crime and Policing Act;
  a) where the offence occurred in any premises or open space (including car parks, gardens and shopping centres) belonging to businesses which are members of a BCRP
  b) immediately beyond such premises where there are reasonable grounds to believe the offence is connected with the person's presence at such premises

In these circumstances a police officer or police staff investigator shall inform the person in writing that details of the offence and the individual's identity will be disclosed to the co-ordinator of the BCRP. The individual will be informed that this may result in the BCRP excluding him/her from all of its members’ premises. The person will also be informed that he or she has the right to make representations. A written record will be made of the service of the notice. If no objection is received within 72 hours of the notification, disclosure may follow. Should the person make representations, the district commander will make the final decision and the person informed of the result in writing. The justification for disclosure or otherwise must be recorded on the K-MIP form.

3.2.4. There will be occasions where there is no positive outcome, such as where a victim is unwilling, or unable to support, or there is evidence of involvement, but not sufficient to charge. In these cases, if there is a risk or further offending, or a strong public interest, representations will be made to an officer of inspector rank, or above. The officer will consider all the circumstances in the case and form a view as to whether disclosure is justified in the public interest, or to prevent further offending. If the judgement is made that disclosure is necessary, the officer will make a record of their decision and reasoning on the K-MIP form. In these circumstances the requirement to inform the person in writing as outlined above shall still apply.

3.2.5. If the person makes no representation or the district commander has made a decision following representation, the BCRP co-ordinator will be informed of the details in writing. No information about previous convictions or intelligence shall be provided unless a full risk assessment, in accordance with policy S0401 'The supply of police photographs/images/intelligence' has been carried out. Conditions on the use of such information will be applied unless to do so would be likely to prejudice the prevention or detection of crime the subject of the information shall be informed of any disclosure.

3.3. Serving the exclusion notice

3.3.1. There will be occasions when BCRP co-ordinators seek police assistance in serving an exclusion notice, the police will only be involved in such service if satisfied that the potential for a breach of the peace is high. Such involvement will be limited to police presence when a representative of the partnership serves the notice.

3.3.2. Before police participation in the service of an exclusion notice is agreed, the partnership co-ordinator must put in writing a request, to the district commander for the area concerned. The letter must state that the partnership is satisfied that an exclusion notice is justified (with reasons) and intends to issue such a notice and that it believes (giving reasons) that there is a realistic prospect that a breach of the peace will occur when the notice is served. The police will check each request and the district commander or his assigned representative shall decide whether police officers should be present when a member of the partnership serves the notice. The scheme co-ordinator shall be informed in writing of the district commander’s decision.

3.3.3. All requests must be signed by the scheme co-ordinator of the respective partnership.

3.3.4. On no occasion will the police draw up exclusion notices on behalf of the partnership nor will it instruct that such notices be drawn up or served. That responsibility rests with the partnership whose co-ordinator will communicate the decision, where necessary, to the police.

3.3.5. Where an exclusion notice has been served by the partnership without the assistance of the police, the police should be provided with a copy of the notice so that Kent Police can update Athena.

3.3.6. Monitoring and reporting systems will be adopted by the BCRP that are designed to show whether exclusion notices are potentially being serviced disproportionally against particular groups e.g. based on ethnicity. If monitoring shows that exclusion notices are being serviced disproportionally against particular groups the service will conduct further analysis to identify the causes.

3.4. Requests for information by BCRPs

3.4.1. BCRP co-ordinators will maintain their own records and may from time to time seek information relating to suspects. No disclosure shall be made unless a full risk assessment in accordance with policy S401 'The supply of police photographs/images/intelligence' has been carried out. Conditions on the use of such information will be applied. The subject of the information shall be informed unless to do so would be likely to prejudice the prevention or detection of crime. A request can be made using the K-MIP form referred to earlier and submitted to a designated officer in the Community Safety Units or Divisional Intel Unit.

3.4.2. Where no request by a Business Crime Reduction Partnership for was made under section 3.2 or 3.4 but it is believed that disclosure could be made to achieve the purpose set out in paragraph 2 then the circumstances should be reviewed in the light of this policy and the appropriate information may be disclosed by Kent Police. The representation and audit process will still apply and the person must be informed in writing of their opportunity to object in advance of any disclosure. If no objection is received within 72 hours of the notification, disclosure may follow.

3.5. Privacy of information

3.5.1. All personal data collected by and shared between the agencies and organisations mentioned within the information sharing agreement are subject to the provisions of the GDPR, Data Protection Act 2018, and other relevant legislation including without limitation to the Human Rights Act. The data protection act principles as set out in the Act must be adhered to at all times. These are summarised below.

• processed lawfully, fairly and transparently
• processing is for a specified and lawful purpose
• the data is adequate, relevant and limited to that which is necessary for the purposes(s) of processing
• the data is accurate, relevant, and where necessary kept up to date
• the data is not retained longer than is necessary for the purpose(s) it is being processed
• appropriate technical and organisational measures secure the personal data
• accountability, controller must be able to demonstrate compliance to the obligations and principles. This includes keeping records of processing, policies, staff training, completion of DPIA,s etc.

Kent Police is under statutory duty to promote fairness and equality. It takes into consideration the Equality Act 2010.

As a listed authority in equalities legislation, the legal liability for meeting the duty within this partnership rests with Kent Police. This means that Kent Police is required to make sure that the partnership takes account of the duty in its work, and that all members of the partnership are aware of Kent Police’s legal responsibilities. These legal responsibilities are to:

• eliminate unlawful discrimination
• promote equal opportunities
• promote good relations between people of different racial groups

4. Equality Impact Assessment (EIA)

4.1. This policy has been assessed with regard to its relevance to race and diversity equality. As a result of this assessment the policy has been graded as having a medium potential impact. 

5. Monitoring and review

5.1.  Continued monitoring of this policy will be carried out by the Crime Reduction Project Officer responsible for BCRPs at FHQ. This policy is next due for review in September 2026.

6. Related force policies and procedures 

• S401 - the supply of police photographs/images/intelligence 
• W1014 - information sharing agreements 

7. Other source documents 

• Data Protection Act 1998
• Human Rights Act 1998
• MoPI (Chapter 6)
• KMIP sharing of personal data document

8. Security

8.1. Kent Police have measures in place to protect the security of your data in accordance with our Information Management policy.

9. Retention and disposal of records

9.1. Kent Police will hold data in accordance with our Records Review, Retention and Disposal policy.